Out-of-bounds read In openssl
Description
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.2 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2f-r0 || =1.0.2g-r0 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
alpine v3.3 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2f-r0 || =1.0.2g-r0 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
alpine v3.4 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2e-r1 || =1.0.2f-r0 || =1.0.2f-r1 || =1.0.2f-r2 || =1.0.2g-r0 || =1.0.2g-r1 || =1.0.2g-r2 || =1.0.2g-r3 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
alpine v3.5 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2e-r1 || =1.0.2f-r0 || =1.0.2f-r1 || =1.0.2f-r2 || =1.0.2g-r0 || =1.0.2g-r1 || =1.0.2g-r2 || =1.0.2g-r3 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
alpine v3.7 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2e-r1 || =1.0.2f-r0 || =1.0.2f-r1 || =1.0.2f-r2 || =1.0.2g-r0 || =1.0.2g-r1 || =1.0.2g-r2 || =1.0.2g-r3 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
 debian 11 | >=0 <1.0.2h-1 | 1.0.2h-1 | |
debian 12 | >=0 <1.0.2h-1 | 1.0.2h-1 | |
alpine v3.6 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2e-r1 || =1.0.2f-r0 || =1.0.2f-r1 || =1.0.2f-r2 || =1.0.2g-r0 || =1.0.2g-r1 || =1.0.2g-r2 || =1.0.2g-r3 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
alpine v3.8 | =0.9.8i-r0 || =0.9.8j-r0 || =0.9.8k-r0 || =0.9.8k-r1 || =0.9.8k-r2 || =0.9.8k-r3 || =0.9.8k-r4 || =0.9.8k-r5 || =0.9.8k-r6 || =0.9.8k-r7 || =0.9.8l-r0 || =0.9.8l-r1 || =0.9.8m-r0 || =0.9.8n-r0 || =0.9.8n-r1 || =1.0.0-r0 || =1.0.0a-r0 || =1.0.0a-r1 || =1.0.0a-r2 || =1.0.0a-r3 || =1.0.0a-r4 || =1.0.0b-r0 || =1.0.0c-r0 || =1.0.0d-r0 || =1.0.0e-r0 || =1.0.0f-r0 || =1.0.0g-r0 || =1.0.0h-r0 || =1.0.1-r0 || =1.0.1a-r0 || =1.0.1b-r0 || =1.0.1c-r0 || =1.0.1c-r1 || =1.0.1c-r2 || =1.0.1c-r3 || =1.0.1d-r0 || =1.0.1d-r1 || =1.0.1e-r0 || =1.0.1e-r1 || =1.0.1e-r2 || =1.0.1e-r3 || =1.0.1e-r4 || =1.0.1e-r5 || =1.0.1e-r6 || =1.0.1e-r7 || =1.0.1f-r0 || =1.0.1g-r0 || =1.0.1g-r1 || =1.0.1g-r2 || =1.0.1g-r3 || =1.0.1h-r0 || =1.0.1i-r0 || =1.0.1i-r1 || =1.0.1i-r2 || =1.0.1i-r3 || =1.0.1j-r0 || =1.0.1k-r0 || =1.0.1l-r0 || =1.0.2-r0 || =1.0.2a-r0 || =1.0.2a-r1 || =1.0.2b-r0 || =1.0.2c-r0 || =1.0.2d-r0 || =1.0.2e-r0 || =1.0.2e-r1 || =1.0.2f-r0 || =1.0.2f-r1 || =1.0.2f-r2 || =1.0.2g-r0 || =1.0.2g-r1 || =1.0.2g-r2 || =1.0.2g-r3 || >=0 <1.0.2h-r0 | 1.0.2h-r0 | |
debian 14 | >=0 <1.0.2h-1 | 1.0.2h-1 |
1-10 of 19
10
Aliases
1. CVE-2016-21052. NVD-2016-21053. OSV-ALPINE-2016-21054. OSV-2016-21055. OSV-DEBIAN-2016-21056. GCVE-2016-21057. SECURITY-CVE-2016-21058. SECURITY-TRACKER-CVE-2016-21059. kb.juniper.net10. lists.apple.com11. lists.fedoraproject.org12. lists.fedoraproject.org13. lists.fedoraproject.org14. lists.opensuse.org15. lists.opensuse.org16. lists.opensuse.org17. lists.opensuse.org18. lists.opensuse.org19. lists.opensuse.org20. lists.opensuse.org21. lists.opensuse.org22. lists.opensuse.org23. lists.opensuse.org24. lists.opensuse.org25. lists.opensuse.org26. lists.opensuse.org27. lists.opensuse.org28. lists.opensuse.org29. lists.opensuse.org30. packetstormsecurity.com31. rhn.redhat.com32. rhn.redhat.com33. rhn.redhat.com34. rhn.redhat.com35. rhn.redhat.com36. rhn.redhat.com37. rhn.redhat.com38. rhn.redhat.com39. tools.cisco.com40. DEBIAN-dsa-356641. oracle.com42. oracle.com43. oracle.com44. oracle.com45. securityfocus.com46. securityfocus.com47. securitytracker.com48. slackware.com49. ubuntu.com50. bto.bluecoat.com51. h20566.www2.hpe.com52. h20566.www2.hpe.com53. h20566.www2.hpe.com54. h20566.www2.hpe.com55. kc.mcafee.com56. security.gentoo.org57. security.netapp.com58. source.android.com59. support.apple.com60. freebsd.org61. openssl.org
References
1. https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf2. https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=5b814481f3573fa9677f3a31ee51322e2a22ee6a3. http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html4. http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html5. http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html6. http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html7. http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.